Attempt to get feeder to use API credentials to authenticate to MQTT

[mbillow]

According to the Konexios docs, the feeder uses its API key data to try and authenticate to the MQTT broker. We are able to get the feeder to connect by not enabling authentication on the broker, but this is a big security issue. It would be trivial to discover the broker, subscribe to the # topic, and replay the commands we send to control the feeder.

This would require us to generate and store actual API keys for feeders, instead of just returning random garbage on /gateways/{gateway_id}/config Kronos endpoint.

[mbillow]

@kruton Can you take a look and see if "pegasus" is in the firmware anywhere. The docs make it sound like it is always the MQTT username.

[kruton]

The only place it mentions pegasus is in this MQTT login function where VHOST "%s" ends up being identical to "/pegasus:%s".

[kruton]

We can add a special authentication plugin for HBMQTT broker. There is some documentation in an issue on HBMQTT. Also, someone talked about it on gitter:

first you have to package your plugin class with a setup.py file contaning the following section :

entry_points = {
    'hbmqtt.broker.plugins': [
            ‘mongo_auth_plugin = hbmqtt.plugins.authentication:MongoAuthPlugin’,]
}

then you have to publish your package using pip (locally).
in the broker configuration file, don’t forget to add ‘mongo_auth_plugin’ to the list of auth.plugins
something like :

auth:
   plugins: [‘mongo_auth_plugin’, ‘auth_anonymous']

note that I’ve not tested this. I’m just writing what I would do ...

[mbillow]

Yah, it looks like we should just be able to implement something simple that follows the pattern of their current auth plugins and reads from the SQLite DB

[kruton]

I got it authenticating with a unique password, but it's still not a secure solution. Anyone could call the /config URL currently to get the API key as well. I suppose it makes the attack more difficult.

[mbillow]

Well, it looks like we both spent time implementing something in this space. My fault for not being more clear on that front.

I had this same thought and was planning on digging into making our current HTTP calls also validate API keys. We could then have a togglable “discovery mode” that allows new feeders to connect and get new API keys.